MikroTik

baragoon

/tool netwatch

baragoon

/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254

this?

baragoon

works fine for me with this settings

port=587 server=smtp.gmail.com tls=starttls

baragoon

what is the point of BGP instance? looks like we have the same in the template?

baragoon

you need to recreate containter after that (and don't forget to change addrs/route inside veth)

baragoon

attach veth to the main LAN bridge to obtain ip from the same subnet as your LAN

baragoon

support@mikrotik.com

baragoon

baragoon

src-nat

baragoon

maybe power cycle is needed after RAM increase?

baragoon

cool story

baragoon · Re: dhcp server Screenshot 2025-05-15 at 15.25.59.png

Screenshot 2025-05-15 at 15.25.59.png

baragoon

you need to add an option first and then assign to the lease

baragoon

use dhcp-option 3 for specific static lease

baragoon

Doesn't

/system/watchdog

do the same thing?

baragoon

How and with what did you test?

baragoon

2600::

baragoon

Hi,
Do you know the difference between megabits (Mbps) and megabytes (MB)?

baragoon

It is unclear to me.

same

P.S. I have a tens of Mikrotik routers running BGP, but without a clear explanation it's hard to help.

baragoon

sounds like a MTU issue

baragoon

@eltikpad Mikrotik automatically add /32 to the ipv4 sessions remote.address (the same with ipv6 and /128) in the bgp connection

baragoon

we need to guess the rest of your configuration?

baragoon

I'm having troubles with connecting to wifi 2.4GHz on hap ax^3

please explain in details

baragoon

cool story

baragoon

ansible

baragoon

please change the topic name, "Routing filter not working" - is a false statement

baragoon

you mean 802.3ad?

baragoon

[tik] > /system/health/print 
Columns: NAME, VALUE, TYPE
#  NAME         VALUE  TYPE
0  voltage      23.8   V   
1  temperature  43     C

[tik] > :global temp [/system/health/get 1 value]

[tik] > :put $temp
43

baragoon

You may use /routing/filter/num-list like this: /routing filter num-list add comment=some_bad_as disabled=no list=BAD-AS range=200993 add comment=another_bad_as disabled=no list=BAD-AS range=200994 /routing filter rule add chain=some_chain disabled=no rule="if (bgp-as-path [[:BAD-AS:]]) {reject...

baragoon

An RB4011 (7.18rc1) on my side <-6to4 tunnel-> HE tunnel broker (Frankfurt, DE 216.66.80.30 node) on the other side. Was working fine on 7.17.x and also 7.18 untill beta6 (version I went back to). P.S. I'm sorry, I can't provide supout in this case (I would need to redact/remove 50% of the config b...

baragoon

Error parsing config file

baragoon

You can leave dynamic LL addresses on globally and add single manual LL address and select this checkbox which will override just a single LL address for this particular interface.

gotcha, thank you!

baragoon

Sorry if I did misunderstand something that you are trying to do, but, if you disable LL addresses globally, then, if you need to use global addresses, then you should add LL also manually. Here is an example. Am I missing something what is not working for you? [admin@MikroTik] > :put [/ipv6/settin...

baragoon

According to the documentation: auto-link-local (yes | no; Default: yes) If newly created address is manual link-local address this setting allows to override dynamically created IPv6 link-local address. https://help.mikrotik.com/docs/spaces/ROS/pages/328247/IP+Addressing when auto-link local is di...

baragoon

What does this checkbox do?

baragoon

viewtopic.php?t=203686

baragoon

hold-time=3m keepalive-time=1m uptime=1m50s40ms last-started=2025-01-21 08:20:46 prefix-count=0 prefix-count=0 here means that you are receiving zero prefixes, but the question is about adversing prefixes, right? can you run this and post the output? /routing/bgp/advertisements/print where peer=test

baragoon

it work for everyone except of you...

baragoon

/routing filter rule add chain=test-chain-out disabled=no rule="if (dst in vxlan) {accept}"
/routing bgp connection set output.filter-chain=test-chain-out test

baragoon

you should wait for someone with the magic crystal ball

baragoon

Route Selection is still a mystery?

baragoon

OH WOW!

baragoon

Not the tunnel endpoint for route destination but WAN address

baragoon

You need to set on site B route to Site A public up via local gateway.

baragoon

try to set your output filter chain like this:

rule="if (dst in advertiseBGP_ipv4) {accept}"

baragoon

maybe other routes local-pref is lower?
again a guessing games via screenshots

baragoon

CHR & ISO? Is it something new?

baragoon

Have you set this parameter to the bgp session on the RR or client?
I'll recheck my config, but I'm sure that my RR with this option sends prefixes with correct gateway to the clients.

baragoon

for sure, but it works

baragoon

setting

nexthop-choice=force-self

for bgp session works for me

baragoon

/routing filter num-list
add comment="RFC 6996" list=BOGON-AS range=64512-65534
/routing filter rule
add chain=your_chain disabled=no rule="if (bgp-as-path [[:BOGON-AS:]]) {reject}"

baragoon

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted... partitioning is a great thing, but... it is not available everywhere, I wish to have it for CHR, but again... but... but... but...

baragoon

yes, to simulate succesfull app start inside the container

baragoon

you could also try to set
tail -f /dev/null
for your Endpoint/CMD to test container start

baragoon

@EdPa, @normis thank you

baragoon

Please clarify "not working" - container not importing, container not starting, etc.?
Any errors in the logs?

baragoon

What are my options if I want to have 2 networks at home

Change ISP

Register an ASN, rent /48 (or more) and announce with BGP via your ISP

Resign oneself

baragoon

can you show your ipv6 firewall config?

baragoon

have you tried with another PC/laptop/mobile device?

baragoon

for the start you need to assign /64 (with advertise enabled) to your VLAN interfaces and enable ipv6/nd for these VLANs, and then your LAN devices should receive ipv6 inside the VLANs

baragoon

I see that logging of container actions was changed (but can't find anything related in the changelog), now every container start logged to the system log =\ I have a container which is started every 5 minutes by the scheduler, did the work and stops, now my log is spammed with this: 2024-11-14 20:5...

baragoon

okay, can you show us your configs from "problematic" peers?

baragoon

obviously, the configuration on both sides
P.S.
what ROS version?

baragoon

Forum members' favorite pastime is to guess the problem from a screenshot...

baragoon

if you changed default ssh port and allow connections in your firewall, then yes
but without your config we can only guess

baragoon

I'm not using RIPE RIS live or Routeviews server, this example is for Cymru bogons BGP session.

baragoon

like this...: /routing bgp connection add address-families=ipv6 (or ip) as=your_as disabled=no input.filter=eBGP-peer-in local.address=your_addr .role=ebgp-peer multihop=yes name=eBGP-peer-v6-1 output.filter-chain=eBGP-peer-out .network=bgp-networks remote.address=remote_addr .as=remote_as routing-t...

baragoon

Hi
If you post something interesting (you think so) please include English translation. Official forum language is English and your Italian blog is not understandable for the major forum users.
Thank you.

baragoon

@pe1chl tried via ssh and winbox terminal - the same, 7.16+ (CHR) affected

baragoon

Hi, Routing filters are partialy broken on 7.16+ Instead of expected pref=201 it set to 1, looks like + or - just ignored. Works fine on 7.15.3 https://help.mikrotik.com/docs/spaces/ROS/pages/74678285/Route+Selection+and+Filters * typo (set bgp-local-ref instead of set bgp-local-pref) Command: set T...

baragoon

on 7.15.3 everything works as expected

baragoon

Hi, Instead of expected pref=201 it set to 1, looks like + or - just ignored. Is it a normal behaviour, or I'm doing something wrong? Tested on 7.16+ https://help.mikrotik.com/docs/spaces/ROS/pages/74678285/Route+Selection+and+Filters * typo (set bgp-local-ref instead of set bgp-local-pref) Command:...

baragoon

bgp-out-med…

baragoon

Because you should use bgp-out-med for output chain

baragoon

@itrack, describe your problem and show your configuration.

baragoon

someone forgot to read the documentation...

baragoon

ipv6 link local addrss are not deleteable after update from 7.15.3 using this method (for dn42 peering) /ipv6/pool/add name=link-local prefix=fe80::/56 prefix-length=64 /ipv6/address/add from-pool=link-local advertise=no address=::1 interface=bridge and (not related to 7.16) - unable to add more tha...

baragoon

@Amm0, thank you so much!

baragoon

Hello scripting gurus. Please advise how to assign data from text file to the variables. I have a next file with content: SCRIPT_VERSION=1.2.1 REQ_ID=01J8C5ZV2AY6V6HWEB6F4HQJW5 REQ_IP=172.21.104.34 REQ_FAMILY=1 REQ_CREATED=2024-09-22 06:16:32 how to set variable value for $reqid to be a 01J8C5ZV2AY6...

baragoon

Use autorun script
Example is here viewtopic.php?t=200807

baragoon

Hi normis,

1) yes, to manage all configuration of these MikroTik devices 
2) self hosted for MikroTik router, *nix and container
3) mass auto-upgrade, configuration, provisioning, monitoring, backups (diff history of exports)
4) doesn't really matter

baragoon

Use local-pref in the filters

baragoon

default rule action is reject, if you didn't accept this route in your input chain before, this rule will be filtered /routing/route/print where ospf Flags: F - FILTERED, A - ACTIVE; o - OSPF Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW DST-ADDRESS GATEWAY AFI DIST...

baragoon

baragoon

I’m using VVRP for the failover. Installed keepalived on Pi, added floating IP between router and Pi and no problem with client ip in the logs.

baragoon

just my 2 cents, you can use (ipv4) dhcp-client script to trigger your ipv6 connection upon link down/up

baragoon

@StvGdsn CTRL+H is your friend

baragoon

Hi,

I have never used groups. Can you give me an example of how you use groups

regards

viewtopic.php?p=1096425#p1096425

baragoon

We have peering with Google at several IX-es without BGP-GR without any problems.

baragoon

Jeez, just launched beta3 on my Macbook. "Update available" it greeted me. It downloaded beta4 and Winbox closed itself after reaching 100%. But it did not re-launch again. And also my Winbox Icon on Desktop (thats where I dragged it from DMG installer) is gone now. Good job, Mikrotik. Yo...

baragoon

Thanks a lot for this updated version of Winbox. A made a quick search on the topic, and I don't think this was reported: it would be nice to have an automatic switch between dark and light themes, following the operating system setting. I use light theme during daylight, and my PC switches to dark...

baragoon

Hi There,

Other issue I found is that tools like ping/traceroute don't allow entering a FQDN like www.google.com. They always expect an IP address. This works in Winbox 3 and it is really useful for me!

Thank you!

+1

baragoon

Mac version - unable to drag multiple items at once. Selected multiple items, drag, but only one was moved.

baragoon

one small thing on MacOS, Enter key is no more acts as "OK" button, now I need to click mouse instead of just pressing Enter like in v3.

baragoon

Quick minor bug report - IPv6 addresses aren't supported in ping window - note red error in below screenshow (8.8.8.8 was a prior IPv4 test)

Знімок екрана 2024-09-03 о 09.30.21.png

baragoon

Hi,
^ stands for the first AS in the path
$ stands for the last AS in the path
If you want to set blackhole for AS13414 then remove ^ from your rule.

baragoon

@normis, please add auto dark/light mode depend on the (local) device color scheme

baragoon

Does anybody have any idea?

Yes, open the support ticket.

baragoon

you can't...

baragoon

@normis, please add also auto dark mode (depends on the global system white/dark mode)

baragoon

System -> Scripts: there's no way to edit scripts. Only options are Run and Remove...

double click on the script name and editor will open

baragoon

No safe mode and undo/redo buttons or I'm blind?

baragoon

it seems no longer possible to change position of the columns (for example the 'name' column in BGP sessions is currently somewhere at the back and I can't drag it to the front).

+1

baragoon

But in the old version comments and groups are the separate entries

baragoon

Good job!
But, please add device groups in the main window like in the old version.

baragoon

Output Filter for the BGP connection, rule "as is"

baragoon

works for me with Google

if (dst in bgp-networks-ix && dst-len in 16-48) {append bgp-communities 15169:13298; accept}

baragoon

/interface bridge filter
add action=drop chain=forward comment=dhcp dst-port=67-68 ip-protocol=udp mac-protocol=ip

Use bridge filter. Also you may try to use a specific in/out interface in this rule.

baragoon

good job

baragoon

did the remote 10/8 have a correct route to your src subnet?

baragoon

try to set nexthop-choice=force-self and then post print of your routes

baragoon

what is your nexthop-choice for the iBGP connections?

baragoon

+ sign after As means ECMP is active

baragoon

how did you test "from Mikrotik"? Directly from router, from device connected to the router, via wire or wifi?

baragoon

why are people so afraid of ipv6?

baragoon

VLAN 1 should be only used for non tagged traffic. Fire your network architector.

baragoon

if you are using BGP, then set pref-src via filters

if (blah-blah-blah) {set pref-src 2001:db8:x:x::y; accept}

baragoon

This is really sucks... stated as 1GB RAM, but

             total-memory: 928.0MiB
               board-name: hAP ax^2

but at the same time, RB5009, also stated as 1GB RAM

             total-memory: 1024.0MiB
               board-name: RB5009UG+S+

where are our 96MB of RAM?

baragoon

/routing/route/print proplist=dst-address,gateway,bgp.as-path

baragoon

dude?

baragoon

@goldenski,
I haven't use ROS6 (only 7) with BGP but will try to help.
Please post your routing filters too.

This is your subnets for advertise, right?

add network=1xx.2xx.1xx.144/29
add network=1xx.2xx.1xx.88/29
add network=2xx.1xx.0.0/29

and you wand to accept only default route, rigth?

baragoon

without your config - it is impossible to advise anything

baragoon

if(bgp-input-remote-as==20000||bgp-input-remote-as==30000||bgp-input-remote-as==40000||bgp-input-remote-as==50000||bgp-input-remote-as==60000) {accept}

or use num-list as mentioned by @mrz

baragoon

In 4 days it was rebooted 3 times.

Started at 7.15 Stable.

7.15 Stable was released yesterday.

baragoon

@loloski
just 127.0.0.1

What about ::1 ?

baragoon

Yes. Setup via WiFi menu your wireless settings.

baragoon

if you are using only Chateu, you don't need a CapsMan, setup as regular router with wifi.

baragoon

You are trying to connect to CapsMan (running on your Chateau) from another Tik AP connected to your Chateau via LAN cable? Can you ping 192.168.88.1 from this AP? If these two statements are correct, try to temporary disable your firewall rules at Chateau and see if AP connects to CapsMan. If yes, ...

baragoon

So, you are already have 192.168.88.1/24 assigned to your bridge, you don't need a dhcp-client on the bridge because there is nowhere to get ip address via dhcp-client in this interface. If you want your PC (and wifi devices) to got and ip address you need only dhcp-server on the bridge interface. Y...

baragoon

what is your WAN interface? LTE?
can you show "ip address print" and "ip route print"?

baragoon

describe your network diagram and desired result, how you are connected to the ISP and how your devices are connected to the Tik

baragoon

you have both dhcp-client & dhcp-server on the interface bridge

baragoon

*) x86/chr - improved panic saving (increased minimal RAM requirements to 256MB);

does this mean that if the free memory is less than 256 megabytes, the router will crash with "out of memory"?

baragoon

Hi,
because ECMP for eBGP is not supported (yet).

baragoon

show your logging settings

baragoon

Mikrotik certified trainer with telnet exposed from WAN.
Say no more...

baragoon

Thank you, @rextended, works like a charm!

baragoon

Thanks @jaclaz, reading and trying more and more

baragoon

Dear scripting gurus, I would like to ask you for help. Please help me with a simple script, which will monitor /log for one exact message - "FCC: Attemtped to send a frame with no bonded connections established" and if this message appears in the log - restart container. There is no probl...

baragoon

RPKI is another measure for routing security for sure as pe1chl said, but IRR filters sadly still have their place and are as important - there was just no decent systems I could find to manipulate these on Mikrotik, like there are for the big name vendors. I'm pretty happy with the setup now, drop...

baragoon

+1, I would like to know too

baragoon

“Guess the error” game

baragoon

Thanks for info. Do you know from what version? 7.13.x still shows CHR

My quote was from 7.15rc topic

baragoon

There is a change not included in change list. /system resource board-name for CHR now has extra information about the host/platform it is running on. For example, it might now be "CHR x86 Xen HVM domU" So, testing if board-name is "CHR" no longer works; you'd need to use someth...

baragoon

both versions are suitable for BGP

baragoon

/system/resource get board-name

baragoon

does ospf allowed by firewall?

baragoon

The most-specific route will always be preferred. Isn't it?

baragoon

Set allowed addresses for ssh in the ip/services

baragoon

On two separate occasions, including this one and another, I've experienced my MikroTik hAP ac3 dying after updating RouterOS and Routerboard. My usual process is to update RouterOS first, then restart, and then install Routerboard if there's an update available. However, on both occasions, my rout...

baragoon

13 years… and still no such option…

baragoon

add action=accept chain=input comment="Gitea SSH" dst-port=22 in-interface-list=WAN protocol=tcp

remove this

baragoon

Let me guess. Your router ssh is listen on port 22?
show your

/ip/services/print

baragoon

use large (or ext)

baragoon

dude server enabled on this device?
looks like a wrong credentials in dude for this device

baragoon

The Hex, for example isn't recommended to be used with RoS 7 from what I've seen posted multiple times.

BTW, hEX works great with 7.14.1 and even can handle 4 full ipv6 BGP transit sessions.

baragoon

Hi,
so, you have added static lease in the dhcp-server, right? Then remove unneded static lease in the same place where you have added them.

baragoon

+1 vote for AX2

baragoon

some kind of loopback-o-phobia

baragoon

The license IS shown in the title bar..

maybe I'm blind, can't see anything license related in the winbox title bar

baragoon

Hi,
try nexthop-choice=force-self

baragoon

looks ok for me, have you tried to ask your ISP?
And if you ping a 2001:4450:10:284::1 is it the same picture with "unreachable"?

baragoon

can you also show (with some part of addr hidden) your

/ipv6/address/print
/ipv6/route/print
/ipv6/neighbor/print

?

baragoon

Huh? /ipv6 settings set accept-redirects=no accept-router-advertisements=no disable-ipv6=yes /ipv6 address add from-pool=ipv6-pool interface=bridge /ipv6 dhcp-client add add-default-route=yes disabled=yes interface=ether1 pool-name=ipv6-pool prefix-hint=::/56 rapid-commit=no request=prefix use-peer-...

baragoon

We can start guessing, or maybe call in someone with psychic abilities, or we can look at your config and give you some advice.
Choose one.

baragoon

impossible to understand your config where all ip addrs are x.x.x.x

baragoon

Well, the first victim RB750Gr3 runs fine with 7.14 around a week, but after today's planned reboot didn't comes up... at remote site without people

baragoon

You can post it here or send it to email:
kipofi3506@ukgent.com

sent by email

baragoon

What is this?

baragoon

iirc Mikrotik containers are not docker based

baragoon

In version 7 logic is changed. If no accepted by filters, they are will populate routing table but Filtered. Create filters (subnets, or for /32 is up to you) then select filters for in and out.

baragoon

Gateway is wrong. You need to set it not just interface. Two options: link-local-addr%ether1 or global addres without %ether1

baragoon

Apply correct filters to accept these routes

baragoon

Thank you, very useful!
But I think, that peers must be declared from /routing/bgp/connection and then compared with /routing/bgp/session for v7

baragoon

How to change it!? help... please)

why people even didn't tried to google a bit...
https://docs.vultr.com/configure-a-mikr ... -cloud-vpc

baragoon

Is it a joke?

baragoon

if this is doesn't matter for you - just exclude ntp in the desired (critical) topics

baragoon

It's not work anymore.

that's not true, lists are successfully generated

baragoon

I don’t understand what are you trying to say
Winbox as a backup? Can you rephrase?

baragoon

if your router is able to process a million of address list rules - it will work
https://mikrotikconfig.com/firewall/

baragoon

very informative

baragoon

I think it can be done with routing rules. Select src/32, dst 0.0.0.0/0 and drop

baragoon

Hi,
So, what the question is? Restore from non existant backup or what?

baragoon

WUS DIS????

search this topic...

baragoon

Thanks, that's quite a bit. Do you use any special functions within your CHR routers? How many interfaces do you have connected to them? Can you print the output of the /system/resources/pci section to the thread so we can see what resources are in the VM. Columns: DEVICE, VENDOR, NAME # DEVICE VEN...

baragoon

tell us a little about your environment

I don't have detailed HV information, I'm only a client. I only know that some VMs are run on ProxMox (7.3-6, 7.4-17, 7.4-16, 8.1.4) but have no idea about server or NIC models.

baragoon

Upgraded 10 CHRs without issue... what I did wrong? :-)

baragoon

Yahoooo, thank you

baragoon

Hairpin NAT

baragoon

May I ask what Is the meaning of numbers=X I tried but could not find references to that in the manual page: https://help.mikrotik.com/docs/display/ROS/DHCP When you print something (not dhcp only) you will see a numbers on the left, every unique number corresponds a line. If you want to change spe...

baragoon

release/renew ip on client

baragoon

/ip dhcp-server option
add code=6 name=my_dns value="'IP.ADD.RE.SS'"
/ip dhcp-server lease
set dhcp-option=my_dns numbers=X

baragoon

Well, I think it's possible to src-nat via wan /64 and use link-local only for LAN, but I haven't such experience, can't give some detailed advise.

baragoon

Why to complicate the things? Create dhcp-option with desired DNS server and attach it to the static lease.

baragoon

Mikrotik, well played. Your docs are always on the bleeding edge.

baragoon

I think that better option is dhcp-option 6

baragoon

they are definetely comes from ipv6 nd, but you haven't set any dns servers here, looks abnormal.
Try to unmark DNS in the nd and see what's happends

baragoon

/ipv6/nd/export

?

baragoon

Well, another one ISP who think that ipv6 "is the same as" ipv4. Single /64 for WAN port is ok, but push them that they need to read the docs and also give you /48 or /56 for LAN. Their implementation is totally wrong.

baragoon

Tunnel and LAN v6 should be on the different subnets

Search found 463 matches